GIAC Exam GASF Topic 5 Question 47 Discussion

Actual exam question for GIAC's GASF exam

Question #: 47
Topic #: 5

[All GASF Questions]

While analysis in BlackBerry application list it appears that no third-party applications were installed on the device. Which other file may provide you with additional information on applications that were accessed with the handset?

ABlackBerry NV Items

BContent Store

CEvent logs

DBBThumbs.dat

Show Suggested Answer

Suggested Answer: C

by Rhea at Jan 14, 2025, 10:59 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Olga

5 days ago

Hmm, this is a tough one. I'm gonna go with my gut and say C) Event logs. Unless the exam question is just a ploy to see if we're paying attention and will choose the most ridiculous-sounding option, D) BBThumbs.dat.

upvoted 0 times

...

Twanna

6 days ago

A) BlackBerry NV Items? Sounds like a rejected Scrabble word to me. I'm sticking with C, the event logs are where the real action is at.

upvoted 0 times

...

Latrice

7 days ago

D) BBThumbs.dat? Really? That sounds like something you'd find in a Harry Potter book, not a BlackBerry forensics exam. I'm going with C, event logs all the way.

upvoted 0 times

...

Shelia

16 days ago

C) Event logs seems like the obvious choice here. Who even uses BlackBerry these days anyway? Maybe the examiner is secretly testing our knowledge of ancient technology.

upvoted 0 times

...

Mabel

24 days ago

I'm not sure, but I think D) BBThumbs.dat could also provide information on accessed applications.

upvoted 0 times

...

Lonny

26 days ago

I agree with Lorrine, event logs would show the applications accessed.

upvoted 0 times

...

Edwin

28 days ago

I think the event logs would be the best place to look for more info on applications accessed. You can't always trust what the BlackBerry app list shows, right?

upvoted 0 times